[PR #81] [MERGED] ci(bump-callers): add the cursor-review-auto-label fleet + repair frozen caller pins (BE-4682) #94

New issue

Closed

opened 2026-10-26 22:36:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:36:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/81
Author: @mattmillerai
Created: 7/27/2026
Status: ✅ Merged
Merged: 7/28/2026
Merged by: @mattmillerai

Base: main ← Head: ci/auto-label-bump-fleet

📝 Commits (3)

f9b0619 ci(bump-callers): add the cursor-review-auto-label fleet (BE-4682)
7b360ed fix(bump-auto-label): fail loudly when the main-tip lookup fails (BE-4682)
91022c1 fix(bump-auto-label): precise staleness guard, scoped token, job timeout (BE-4682)

📊 Changes

4 files changed (+255 additions, -11 deletions)

View changed files

📝 .github/bump-callers/README.md (+31 -1)
➕ .github/workflows/bump-auto-label-callers.yml (+200 -0)
📝 .github/workflows/test-bump-callers.yml (+5 -2)
📝 AGENTS.md (+19 -8)

📄 Description

Enrolling a repo as a caller is two steps — merge the caller, and add the repo to its vars.*_CALLERS roster. The second gets skipped, and when it does the pin never moves: the caller drifts behind the reusable indefinitely, then fails much later with no obvious cause. This repo did it to its own ci-groom.yml, whose pin sat unchanged from the day it was written until it failed at startup.

I measured every reusable's real callers (files whose content references a Comfy-Org/github-workflows reusable) across 112 active non-fork repos, against each bump roster:

Reusable	Real callers	Roster	Frozen pins
cursor-review	19	14	6
detect-unreviewed-merge	12	none	all 12 — deferred
agents-md-integrity	6	7	roster is ahead by 1
cursor-review-auto-label	5	none	all 5
assign-reviewers	3	1	2
groom	3	2	1
pr-size	1	1	0
`stale.yml`	0	none	—
`assign-prs-to-author.yml`	0	none	—

This PR

Adds the missing cursor-review-auto-label fleet — 5 callers, no bumper, so not one of their pins had ever moved. A thin entrypoint over the shared bump-callers.sh (not a fork — that script stays one file), plus registration in test-bump-callers.yml, the bump-callers README table, and AGENTS.md.

Two deliberate choices:

Separate fleet from cursor-review. Consumers pin the two reusables independently — many repos run cursor-review without auto-label — so one combined fleet would bump callers of one on a change to the other.
ALLOW_EMPTY: "false". Unlike the fleets seeded [], this one starts non-empty. An empty list here means the variable got clobbered, not that the fleet is unpopulated, and failing loudly beats silently bumping nothing.

The README now also records why stale and assign-prs-to-author have no fleet (zero callers — machinery with no users rots) and that detect-unreviewed-merge's absence is a deferred gap, not an oversight. That table is the part I'd most like a second opinion on.

Already applied outside this PR (Actions variables, no commit)

Prior values backed up first.

CURSOR_REVIEW_CALLERS 14 → 19 — ComfyUI-private, comfy-agent-testing-suite, comfy-cli, comfy-conventions, comfy-toolbox
ASSIGN_REVIEWERS_CALLERS 1 → 3 — website, github-workflows
GROOM_CALLERS 2 → 3 — github-workflows (ci-groom.yml)
AUTO_LABEL_CALLERS seeded with this fleet's 5

Adding this repo to GROOM_CALLERS self-heals the stale ci-groom.yml pin: the next groom.yml change bumps it automatically, and current main is at/after the BE-4214 CLI migration, so the shorter permission grant that caller declares stays valid.

Deliberately excluded: ComfyUI-ghsa-f328-9qc2-fjcf. It runs cursor-review, but it's an ephemeral security-advisory fork that exists to ship one embargoed fix — it doesn't need to stay current, and an automated PR arriving mid-embargo is noise. Trivial to add if you disagree.

Left alone: the agents-md roster lists ComfyUI_frontend at a caller path that doesn't exist. That belongs to the in-flight wave-2 program (BE-3921) and the right fix is landing that repo's caller, not editing the roster around it.

Measurement notes

Three things that would have produced wrong answers if taken at face value:

gh search code reported only 2 groom callers org-wide. It under-reports badly on private repos, so ground truth came from per-repo content reads.
My first scan over-credited this repo by matching its own reusables' header examples — each contains a uses: Comfy-Org/github-workflows/... line. It self-enrolls in exactly 4 fleets via ci-*.yml, not 7. Correcting that is what revealed stale and assign-prs-to-author have zero real callers; their only apparent caller was a comment.
Bulk content reads tripped GitHub's secondary rate limit, whose signature is worth knowing: /rate_limit showed core: 4969/5000 remaining — essentially untouched — while every content call returned "API rate limit exceeded". Secondary limits don't decrement the primary bucket, and /rate_limit is itself exempt, so bucket-remaining can't detect this.

Verification

123 bump-callers functional tests pass; shellcheck -x clean
New entrypoint parses; VAR_NAME / TAG / WORKFLOW_FILE / ALLOW_EMPTY / concurrency group / path filter all asserted
All four variables re-read after writing and confirmed well-formed
check_agents_md.py --root . passes (1 pre-existing CODEOWNERS warning)

Heads-up: #80 also edits AGENTS.md, so whichever lands second may want a trivial conflict resolution in the conventions list.

BE-4682

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/81 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/27/2026 **Status:** ✅ Merged **Merged:** 7/28/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `ci/auto-label-bump-fleet` --- ### 📝 Commits (3) - [`f9b0619`](https://github.com/Comfy-Org/github-workflows/commit/f9b061910a5c5824523d33311c662f08b24b65d1) ci(bump-callers): add the cursor-review-auto-label fleet (BE-4682) - [`7b360ed`](https://github.com/Comfy-Org/github-workflows/commit/7b360edb0774a01283498e87488f0d099d092e23) fix(bump-auto-label): fail loudly when the main-tip lookup fails (BE-4682) - [`91022c1`](https://github.com/Comfy-Org/github-workflows/commit/91022c1d0d59c0cce5ccaa2274f0aac70bb08807) fix(bump-auto-label): precise staleness guard, scoped token, job timeout (BE-4682) ### 📊 Changes **4 files changed** (+255 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `.github/bump-callers/README.md` (+31 -1) ➕ `.github/workflows/bump-auto-label-callers.yml` (+200 -0) 📝 `.github/workflows/test-bump-callers.yml` (+5 -2) 📝 `AGENTS.md` (+19 -8) </details> ### 📄 Description Enrolling a repo as a caller is **two steps** — merge the caller, *and* add the repo to its `vars.*_CALLERS` roster. The second gets skipped, and when it does the pin never moves: the caller drifts behind the reusable indefinitely, then fails much later with no obvious cause. This repo did it to its own `ci-groom.yml`, whose pin sat unchanged from the day it was written until it failed at startup. I measured every reusable's real callers (files whose **content** references a `Comfy-Org/github-workflows` reusable) across 112 active non-fork repos, against each bump roster: | Reusable | Real callers | Roster | Frozen pins | |---|---|---|---| | cursor-review | 19 | 14 | **6** | | detect-unreviewed-merge | 12 | *none* | *all 12 — deferred* | | agents-md-integrity | 6 | 7 | roster is **ahead** by 1 | | cursor-review-auto-label | 5 | *none* | **all 5** | | assign-reviewers | 3 | 1 | **2** | | groom | 3 | 2 | **1** | | pr-size | 1 | 1 | 0 | | `stale.yml` | **0** | none | — | | `assign-prs-to-author.yml` | **0** | none | — | ## This PR Adds the missing **cursor-review-auto-label** fleet — 5 callers, no bumper, so not one of their pins had ever moved. A thin entrypoint over the shared `bump-callers.sh` (**not** a fork — that script stays one file), plus registration in `test-bump-callers.yml`, the bump-callers README table, and AGENTS.md. Two deliberate choices: - **Separate fleet from cursor-review.** Consumers pin the two reusables independently — many repos run cursor-review without auto-label — so one combined fleet would bump callers of one on a change to the other. - **`ALLOW_EMPTY: "false"`.** Unlike the fleets seeded `[]`, this one starts non-empty. An empty list here means the variable got clobbered, not that the fleet is unpopulated, and failing loudly beats silently bumping nothing. The README now also records *why* `stale` and `assign-prs-to-author` have no fleet (zero callers — machinery with no users rots) and that `detect-unreviewed-merge`'s absence is a **deferred gap**, not an oversight. That table is the part I'd most like a second opinion on. ## Already applied outside this PR (Actions variables, no commit) Prior values backed up first. - `CURSOR_REVIEW_CALLERS` 14 → 19 — `ComfyUI-private`, `comfy-agent-testing-suite`, `comfy-cli`, `comfy-conventions`, `comfy-toolbox` - `ASSIGN_REVIEWERS_CALLERS` 1 → 3 — `website`, `github-workflows` - `GROOM_CALLERS` 2 → 3 — `github-workflows` (`ci-groom.yml`) - `AUTO_LABEL_CALLERS` seeded with this fleet's 5 Adding this repo to `GROOM_CALLERS` self-heals the stale `ci-groom.yml` pin: the next `groom.yml` change bumps it automatically, and current `main` is at/after the BE-4214 CLI migration, so the shorter permission grant that caller declares stays valid. **Deliberately excluded:** `ComfyUI-ghsa-f328-9qc2-fjcf`. It runs cursor-review, but it's an ephemeral security-advisory fork that exists to ship one embargoed fix — it doesn't need to stay current, and an automated PR arriving mid-embargo is noise. Trivial to add if you disagree. **Left alone:** the agents-md roster lists `ComfyUI_frontend` at a caller path that doesn't exist. That belongs to the in-flight wave-2 program (BE-3921) and the right fix is landing that repo's caller, not editing the roster around it. ## Measurement notes Three things that would have produced wrong answers if taken at face value: - `gh search code` reported only 2 groom callers org-wide. It under-reports badly on private repos, so ground truth came from per-repo content reads. - My first scan over-credited **this** repo by matching its own reusables' header **examples** — each contains a `uses: Comfy-Org/github-workflows/...` line. It self-enrolls in exactly 4 fleets via `ci-*.yml`, not 7. Correcting that is what revealed `stale` and `assign-prs-to-author` have **zero** real callers; their only apparent caller was a comment. - Bulk content reads tripped GitHub's **secondary** rate limit, whose signature is worth knowing: `/rate_limit` showed `core: 4969/5000` remaining — essentially untouched — while every content call returned "API rate limit exceeded". Secondary limits don't decrement the primary bucket, and `/rate_limit` is itself exempt, so bucket-remaining can't detect this. ## Verification - **123 bump-callers functional tests pass**; `shellcheck -x` clean - New entrypoint parses; `VAR_NAME` / `TAG` / `WORKFLOW_FILE` / `ALLOW_EMPTY` / concurrency group / path filter all asserted - All four variables re-read after writing and confirmed well-formed - `check_agents_md.py --root .` passes (1 pre-existing CODEOWNERS warning) Heads-up: #80 also edits `AGENTS.md`, so whichever lands second may want a trivial conflict resolution in the conventions list. BE-4682 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:36:09 +00:00